# US 2019/0318084 A1 · Securely and efficiently providing user notifications about security actions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0318084 A1 - Document ID: US20190318084A1 - Status: Published application - Kind: A1 - Application number: 15/951,025 - Filed: 2018-04-11 - Published: 2019-10-17 - Earliest claimed: 2018-04-11 - Assignees: CrowdStrike, Inc. - Applicants: CrowdStrike, Inc. - Inventors: Ion-Alexandru Ionescu - Web page: https://patentgrep.com/patent/US20190318084A1 ## CPC - G06F 21/554: {involving event detection and direct action} - G06F 9/545: {where tasks reside in different layers, e.g. user- and kernel-space} - G06F 9/547: {Remote procedure calls [RPC]; Web services} - G06F 21/33: using certificates - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A security agent executing in kernel mode may receive a request from the anti-malware component executing with low privileges in user mode, and, in response, the security agent may perform a security action with respect to a malicious file detected on the computing device. The security agent may then assist the anti-malware component in providing a user notification about the security action by obtaining, on behalf of the anti-malware component, a user token associated with the user session in which the malicious file was detected. The anti-malware component can use the obtained user token to request a pointer to a Component Object Model (COM) interface for outputting the notification in context of the appropriate user session, which allows for securely and efficiently providing the user notification. ## Claims ### Claim 1 A computer-implemented method comprising: receiving, by a security agent executing in kernel mode of a computing device, a request from an anti-malware component executing in user mode of the computing device; performing, by the security agent, a security action with respect to a malicious file detected on the computing device by the anti-malware component; obtaining, by the security agent, a user token associated with a user session in which the malicious file was detected; providing, by the security agent, the user token to the anti-malware component; using, by the anti-malware component, the user token to request a pointer to a Component Object Model (COM) interface for outputting a notification in context of the user session; and outputting, via an output device of the computing device, the notification to indicate that the security action was performed, by receiving the pointer and calling a method of the COM interface. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising executing the anti-malware component in the user mode of the computing device with privileges that are more restrictive than Administrator privileges. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the obtaining the user token is based at least in part on a process identifier (PID) of a process associated with the request from the anti-malware component by: determining, by the security agent, a user account identifier (ID) based at least in part on the PID; calling, by the security agent, an authentication function using the user account ID; and receiving, by the security agent, the user token returned by the authentication function. ### Claim 4 (depends on 3) The computer-implemented method of claim 3, wherein the authentication function comprises at least one of a LsaLogonUser function, a LsaLogonUserEx function, or a direct Remote Procedure Call to Local Security Authority Subsystem Service. ### Claim 5 (depends on 3) The computer-implemented method of claim 3, wherein the calling of the authentication function using the user account ID includes using, by the authentication function, a data structure that includes the user account ID. ### Claim 6 (depends on 5) The computer-implemented method of claim 5, wherein the data structure is a service for user (S4U) data structure, and the user account ID is a user principal name (UPN). ### Claim 7 (depends on 1) The computer-implemented method of claim 1, further comprising determining a user account identifier (ID) of a user who is currently logged into the user session, wherein the obtaining the user token is based at least in part on the user account ID. ### Claim 8 (depends on 7) The computer-implemented method of claim 7, wherein the obtaining the user token based at least in part on the user account ID comprises: calling, by the security agent, an authentication function using the user account ID; and receiving, by the security agent, the user token returned by the authentication function. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, further comprising using, by the anti-malware component, a moniker that specifies a session identifier (ID) of the user session to request the pointer to the COM interface. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, further comprising: determining, by the security agent, the session ID based at least in part on the PID; and providing, by the security agent, the session ID to the anti-malware component for use with the moniker to request the pointer to the COM interface. ### Claim 11 (depends on 1) The computer-implemented method of claim 1, wherein the output device comprises at least one of a display or a speaker of the computing device, and the outputting of the notification comprises at least one of displaying the notification on the display, or audibly outputting the notification via the speaker. ### Claim 12 (depends on 1) The computer-implemented method of claim 1, wherein the COM interface comprises an IUserNotification interface. ### Claim 13 A computing device comprising: a processor; an anti-malware component configured to be operated by the processor to: execute in user mode of the computing device; and send a request to a security agent in kernel mode of the computing device requesting the security agent to perform a security action with respect to a malicious file detected by an anti-malware scanner associated with the anti-malware component; and the security agent configured to be operated by the processor to: execute in the kernel mode of the computing device; receive the request from the anti-malware component; perform the security action in response to receiving the request; obtain a user token associated with a user session in which the malicious file was detected; and provide the user token to the anti-malware component, wherein the anti-malware component is further configured to be operated by the processor to cause a notification to be output in context of the user session by employing the user token to request a pointer to a Component Object Model (COM) interface for outputting the notification, and by calling a method of the COM interface with the pointer. ### Claim 14 (depends on 13) The computing device of claim 13, wherein the anti-malware component is configured to execute in the user mode of the computing device with privileges that are more restrictive than Administrator privileges. ### Claim 15 (depends on 13) The computing device of claim 13, wherein the anti-malware component is further configured to be operated by the processor to use a moniker that specifies a session identifier (ID) of the user session to request the pointer to the COM interface. ### Claim 16 (depends on 13) The computing device of claim 13, wherein the security agent is further configured to be operated by the processor to obtain the user token based at least in part on a process identifier (PID) of a process associated with the request from the anti-malware component by: determining a user account identifier (ID) based at least in part on the PID; calling an authentication function using the user account ID; and receiving the user token returned by the authentication function. ### Claim 17 (depends on 16) The computing device of claim 16, wherein the calling of the authentication function using the user account ID includes using, by the authentication function, a data structure that includes the user account ID. ### Claim 18 (depends on 13) The computing device of claim 13, wherein the security agent is further configured to be operated by the processor to: determine a user account identifier (ID) of a user who is currently logged into the user session; and obtain the user token based at least in part on the user account ID. ### Claim 19 A non-transitory computer-readable medium storing computer-executable instructions that, when executed by one or more processors of a computing device, cause the computing device to: execute an anti-malware component in user mode of the computing device to send a request to a security agent in kernel mode of the computing device requesting that the security agent perform a security action with respect to a malicious file detected by an anti-malware scanner associated with the anti-malware component; and execute the security agent in the kernel mode of the computing device to: receive the request from the anti-malware component; perform the security action in response to receiving the request; obtain a user token associated with a user session in which the malicious file was detected; and provide the user token to the anti-malware component, wherein the anti-malware component is further configured to cause a notification to be output in context of the user session by employing the user token to request a pointer to a Component Object Model (COM) interface for outputting the notification, and by calling a method of the COM interface with the pointer. ### Claim 20 (depends on 19) The non-transitory computer-readable medium of claim 19, wherein the anti-malware component is configured to execute in the user mode of the computing device with privileges that are more restrictive than Administrator privileges. ### Claim 21 (depends on 19) The non-transitory computer-readable medium of claim 19, wherein the anti-malware component is further configured to use a moniker that specifies a session identifier (ID) of the user session to request the pointer to the COM interface. ### Claim 22 (depends on 19) The non-transitory computer-readable medium of claim 19, wherein the security agent is further configured to obtain the user token based at least in part on a process identifier (PID) of a process associated with the request from the anti-malware component by: determining a user account identifier (ID) based at least in part on the PID; calling an authentication function using the user account ID; and receiving the user token returned by the authentication function. ### Claim 23 (depends on 22) The non-transitory computer-readable medium of claim 22, wherein: the authentication function comprises a LsaLogonUser function; the user account ID is a user principal name (UPN); and the calling of the authentication function based at least in part on the user account ID includes using, by the LsaLogonUser function, a service for user (S4U) data structure that includes the UPN. ### Claim 24 (depends on 19) The non-transitory computer-readable medium of claim 19, wherein the security agent is further configured to: determine a user account identifier (ID) of a user who is currently logged into the user session; and obtain the user token based at least in part on the user account ID.